A newly identified malware component within the Project CAV3RN framework is exploiting Microsoft Outlook calendar events dated for 2050 to conceal command-and-control (C2) communications. This tool also utilizes DNS AAAA responses as a fallback mechanism to restore Microsoft Graph credentials when cloud authentication fails.
Kaspersky researchers have linked this activity to highly targeted cyberespionage operations against Israeli organizations. While the broader CAV3RN ecosystem has been associated with Iran-linked activities, some researchers assess the OilRig attribution with low confidence.
Outlook as a C2 Channel
The new communication module, identified as AzureCommunication.dll, appears designed to replace an earlier HTTP/WebSocket C2 component within CAV3RN’s modular architecture. It leverages Microsoft Graph API access to a compromised Microsoft 365 mailbox, transforming the default Outlook calendar into a two-way dead-drop channel.
Instead of connecting to an obvious attacker-controlled server, the malware authenticates to Microsoft Entra ID using OAuth 2.0 application credentials. It then accesses calendar events through Microsoft Graph, allowing malicious traffic to blend seamlessly with legitimate Microsoft 365 activity.
Commands, heartbeats, and stolen data are stored in a fixed calendar window: May 13, 2050, from 22:00 to 23:00 UTC. Placing events decades in the future reduces the likelihood that victims or administrators will encounter them in ordinary calendar views. Similar tactics have been observed, with encrypted commands and data hidden in calendar attachments scheduled for 2050.
For operator tasking, the malware searches calendar events using a subject formatted as ‘Event ID:
The malware employs hybrid encryption for inbound commands: an RSA-encrypted AES key protects an AES-256-GCM encrypted payload. This approach ensures confidentiality and integrity while using a legitimate cloud platform as the transport layer.
When sending results, the implant creates a temporary calendar event, uploads encrypted output in attachments of up to 10 MB, then changes the subject to ‘Boss Report ID:
The capitalization difference between inbound ‘file0.txt’ and outbound ‘File0.txt’ attachment names may provide defenders with a useful hunting clue.
The framework also creates and replaces heartbeat events labeled ‘Boss update ID:
If Microsoft Graph token acquisition or tenant validation fails, AzureCommunication.dll switches to a DNS-based recovery process. It queries actor-controlled DNS infrastructure using AAAA records, treating IPv6 addresses as containers for configuration fragments rather than network destinations.
The malware retrieves updated information, including Microsoft Entra tenant IDs, client IDs, client secrets, and target mailbox addresses in 14-byte segments. Each query contains a hex-encoded agent identifier, enabling the operator-controlled authoritative DNS server to customize responses for each specific victim.
This sophisticated use of legitimate services like Microsoft Outlook and DNS for C2 communications highlights the evolving tactics of cyber adversaries. Organizations must enhance their monitoring of cloud service activities and implement robust detection mechanisms to identify and mitigate such stealthy threats.
